Google Professional Cloud Database Engineer Question 53
Select 3Google Cloud PlatformYou are designing a secure Cloud SQL instance for your organization. The organization requires that all connections to the database be encrypted and authenticated securely without embedding credentials in application code. Additionally, the organization has a compliance requirement to manage the encryption keys externally. Which of the following configurations should you implement to meet these requirements?
- A
Use the Cloud SQL Auth Proxy to establish secure connections to the database.
- B
Enable SSL certificates for the Cloud SQL instance and require client certificates for connections.
- C
Configure Customer-Managed Encryption Keys (CMEK) for the Cloud SQL instance.
- D
Embed database credentials in the application code to simplify authentication.
- E
Enable public IP for the Cloud SQL instance to allow secure external access.
Show answer and explanation
Correct answers: A, B, C
Explanation
To meet the organization's requirements, you should use the Cloud SQL Auth Proxy for secure, encrypted connections while avoiding the need to embed credentials in code. SSL certificates ensure encryption and authentication, and CMEK fulfills the compliance requirement for externally managed encryption keys. Alternatives like embedding credentials in code or enabling public IP are either insecure or unnecessary.
- A. Correct.
The Cloud SQL Auth Proxy provides encrypted connections between client applications and Cloud SQL, and it eliminates the need to embed credentials in application code.
- B. Correct.
Enabling SSL certificates ensures that all connections are encrypted. Requiring client certificates adds an additional layer of authentication.
- C. Correct.
Using CMEK allows the organization to manage encryption keys externally, meeting the compliance requirement.
- D. Incorrect.
Embedding database credentials in the application code is insecure and does not meet the requirement for secure authentication.
- E. Incorrect.
Enabling public IP increases the attack surface and is not necessary for secure connections, especially when private IPs and the Cloud SQL Auth Proxy can be used.